CYBER SECURITY in the SINGAPORE FINANCIAL SECTOR Tony Chew, Director, Technology Risk Supervision Monetary Authority of Singapore © Tel: WORLD BANK VIDEO SATELLITE CONFERENCE September 10, 2003

CYBER SECURITY and TECHNOLOGY RISK MANAGEMENT M ONETARY A UTHORITY OF S INGAPORE HOW DOES MAS PROMOTE IN THE FINANCIAL SECTOR ?

1. BANKING ACT – PRUDENTIAL REQUIREMENTS. 2. SUPERVISORY AND REGULATORY PROCESS. 3. NOTICES, ADVISORIES AND DIRECTIVES. 4. TECHNOLOGY RISK MANAGEMENT GUIDELINES. 5. INSPECTION AND TECHNOLOGY RISK ASSESSMENT. SAFETY AND SOUNDNESS FRAMEWORK

The 2 largest banks in Singapore were attacked by hackers. UOB in June 2001 DBS in June 2002 TWO HACKING INCIDENTS

On 4 July 2001, UOB discovered an intrusion into its internet banking system. Hackers from Eastern Europe attacked the bank’s online system. HACKING INTO ONLINE BANKING On 19 June 2002, between 8:20 am and 9:20 am, a hacker broke into 21 DBS customer accounts and transferred $62,000 from their accounts to his account. At 10 am, he walked into a branch and withdrew the stolen money.

HACKING INTO CYBER BANKING Web Server Crypto Server Database Server HOST HSM SSL PIN attack Virus/worms, backdoors, keyboard sniffers, AV/FW evasion

TECHNOLOGY RISK MANAGEMENT VULNERABILITIES THREATS CONSEQUENCES AND LOSSES RISK CONTROL AND SECURITY Level of Risk COSTCOST EXPOSUREEXPOSURE

CAMELO T S RISK RATING SYSTEMS INTEGRITY SYSTEMS CONTROLS TECHNOLOGY RISK ASSESSMENT PROCESS IS BASED ON 6 SYSTEMS CRITERIA COMPLIANCECOMPLIANCE SECURITY PRACTICES RECOVERYRECOVERY RISK MANAGEMENT

INTERNET BANKING 1. Establish robust risk management process. 2. Strengthen system availability, security, recoverability. 3. Deploy strong cryptography to protect data. Technology Risk Management Guidelines

TECHNOLOGY RISK MANAGEMENT Delineate responsibility for safety and soundness. Establish responsibility for managing technology risks. Nurture a risk awareness culture. Rectify the weakest security link. Conduct vulnerability and security assessment. Invest in system reliability and integrity. Prepare for contingencies and disruptions. Educate customers on security precautions. Manage outsourcing risks. Guidelines for Financial Institutions

SECURITY GUIDELINES FOR MOBILE BANKING AND PAYMENTS 1. Introduction – authentication and fraud detection 2.Risk management framework 3.Types of services 4.Technology risk management 5.Security practices a) PIN security b) Network and system security c) Cryptographic key management d) General security practices e) Customer education

END